http.app
Zero Data Retention

HTTP METHODS

Compare every standard HTTP method on the properties that decide how clients, caches, and proxies treat it: safe, idempotent, cacheable, whether it carries a body, whether it triggers a CORS preflight, and the status codes it usually returns.

Zero retention: your headers never leave this browser. Verify it yourself in DevTools.

Loading the workbench.

About the HTTP methods

How Can You Verify That Nothing Leaves This Browser?

You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.

  1. Open your browser developer tools with F12, or Cmd+Option+I on a Mac, and select the Network tab.
  2. Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
  3. Click the clear icon in the Network tab so that the log is empty.
  4. Paste real headers into any lane and read the result.
  5. Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.

Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.

2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.

What Do Safe and Idempotent Mean?

A safe method is read-only from the client's point of view: GET, HEAD, OPTIONS, and TRACE should never change anything, so crawlers and prefetchers may call them freely. An idempotent method has the same effect whether it is sent once or ten times: every safe method, plus PUT and DELETE. That is what lets a client or proxy retry it after a dropped connection.

POST and PATCH are neither, by default, so a retry may create a second order or apply a change twice. APIs often add an idempotency key header to make POST retries safe.

Which Methods Are Covered?

  • GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, and TRACE from RFC 9110.
  • PATCH from RFC 5789, for partial updates.
  • QUERY, an IETF draft for a safe, idempotent request with a body, clearly labelled as a draft.

Each card lists the properties, whether a request body is expected, whether the method is CORS-simple, and typical response codes such as 201, 204, and 405.

How Do You Choose Between PUT, PATCH, and POST?

  1. Use PUT to replace the resource at a known URL with the body you send. Sending it twice leaves the same result.
  2. Use PATCH to change part of a resource, with a patch format such as JSON Merge Patch.
  3. Use POST to create something whose URL the server chooses, or to run an action that is not a simple update.
  4. Return 201 with a Location header when a new resource was created.

Which Methods Trigger a CORS Preflight?

Only GET, HEAD, and POST can be simple cross-origin requests. PUT, PATCH, DELETE, and every other method always need an OPTIONS preflight, and the server must list them in Access-Control-Allow-Methods. The CORS checker shows the whole exchange for a real request.

What Other Lanes Are in the Reference Section?

  • HTTP status codes: Every IANA-registered status code, with a page per code.
  • MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.

Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.

Frequently Asked Questions

Can a GET request have a body?

The specification gives a GET body no meaning, many servers and proxies drop it, and fetch refuses to send one. Use query parameters, or POST, or the draft QUERY method.

Is DELETE idempotent if the second call returns 404?

Yes. Idempotence is about the effect on the server, not the response. After one or many DELETE calls the resource is gone, even though later calls may return 404.

What is the HEAD method for?

HEAD returns the same headers as GET without the body. It is used to check whether a resource exists, its size, or whether it changed, without downloading it.

Why does my server return 405?

405 Method Not Allowed means the URL exists but does not support that method. The response must include an Allow header listing the methods it does support.

Was this helpful?